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TO THE CLAIMS 

Please cancel claims 14, 20, 27, 28, and 36, rewrite claims 16, 21, 32, and 37, and amend 
claims 15, 17-19, 22, 26, 29-31, 33-35, and 42-44. as follows. A complete listing of the claims is 
provided below, 

J . ' (Previously Presented) A method of monitoring a network switch having a plurality 
of regular ports between which network traffic data packets are forwarded and an external mirror 
port, comprising: 

selecting at least cms of said regular ports; 

mirroring a data packet of said selected port to said external mirror port; 
extracting the network address information of said mirrored data packet; 
determining port information of said network address information in response to said 
network address information extraction; and 

performing network analysis of said network switch. 

2, (Previously Presented) The method of claim 1, wherein seiid port information 
comprises physical information. 

3, (Previously Presented) The method of claim 1, wherein said port information 
detennination comprises interrogating said network switch to obtain said port information using 
said network address information. 
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4. (Previously Presented) The method of claim 3, wherein said interrogation comprises: 
sending a first request to said network switch requesting a port index corresponding to said 

network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

5. (Previously Presented) The method of claim 1, wherein said network address 
information extraction and said port infonnatian determination are performed in an external 
monitor device. 

6. (CanceDed). 

7. (Previously Presented) The method of claim 4, wherein said port information 
determination comprises placing said mirrorejd data packet in a flrst-in-first-out buffer waiting for 
responses from said network switch, 

8. (Previously Presented) The method of claim 7, wherein said port information 
determination further comprises releasing said mirrored data packet from said first-in-first-out 
buffer after said network switch responds to said requests. 

9. (Previously Presented) The method of claim 7, wherein said port information 
determination further comprises releasing said mirrored data packet from said first-in-first-out 
buffer after a predetermined period of ti me. 
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10- (Previously Presented) The method of claim 1, further comprising maintaining at 
least one lookup table correlating said network address information with said port information. 

U. (Previously Presented) The method of claim 1, wherein said network address 
information comprises a source address of said mirrored data packet. 

12. (Previously Presented) Tlie method of claim 1, wherein said network address 
Lafonnation comprises a destination address of said mirrored data packet. 

13. (Previously Presented) The method of claim 1, wherein said network switch is a 
routing switch, 

14. (Canceled) 

15. (Currently Amended) The method of claim 4416, wherein said port information 
comprises physical information. 

16. (Currently Amended) The method of claim 1 4 , A method to monitor a network 
switch, compn.sing! 

e;^^ma^Y q^taining at least a portion of data packets transmitted fro m said network switch. 

jyherein each of said data packets compriges network address information: 

extracting said networ k address information fr om said obtained portion of data p ackets: 
determining port infor mation of said network address. information in response to said 

network address tnfonnation extraction: and 
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pe rforming network analygis of said network switch using said port informatiOTL- 
wherein said network switch comprises a plurality of regular ports and a mirror port, said 

mirror port being able to mirror network traffic for at least one of said regular ports, wherein said 

portion of data packets are obtained from seiid mirror port. 

17. (Currently Amended) The metliod of claim 44 16. wherein said network address 
information comprises source addresses. 

18. (Currently Amended) The method of claim 44_16, wherein said network address 
information comprises destination addresses. 

19. (Currently Amended) The method of claim 14_lfi, wherein said network switch 
comprises a plurality of regular ports, wherein said portion of data packets are obtained by 
passively tapping at least one of said regxilar ports. 

20. (Canceled) 

21. (Currently Amended) The method of claim 20, A method to monitor a network 
switch, comprising : 

externally obtaining at least a portion of data packets transmitted from said network switch. 

wberein each of said data packets comprises network address information: 

extractinig said netwo rk address information from said obtained portion of data packets: 
determining port information of said network address information in response to said 

network address info rmation extractjon: and 
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perfonning: network a nalysis of said network switch usinp said port infoimation: 
wherein said port informat^g n determination comprises interrogating said network Switch 
to obtain said port informatjo n using said network address info.nnatiQn: and 
wherein said interrogation comprises: 

sending a first request to said network switch requesting a port index correspondtng to said 
network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

22, (Currently Amended) Hie method of daim 4416, wherein said network address 
information extraction and said port information determination are performed in an external 
monitor device. 

23, (Previously Presented) The method of claim 21, wherein said port ir\f oxmation 
determination comprises placing said obtained portion of data packets in a first-in-first-aut buffer 
waiting for responses from said network switch. 

24, (Previously Presented) The method of claim 23, wherein said port information 
determination further comprises releasing a data packet from said first-in-first-out buffer after said 
network switch responds to said first and second requests. 
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25. (Previously Presented) The method of claim 23, wherein said port in/ormatLon 
determination jfuither comprises releasing a data packet from said first-in-first-out buffer after a 
predetermined period of time. 

26- (Currently Amended) The method of claim 44_16, further comprising maintaining at 
least one lookup table correlating said network address information with said port information. 

27. (Canceled) 

28. (Canceled) 

29- (Currently Amended) The method of claim 3S J2, further comprising performing 
network analysis of said network switch using said port information. 

30. (Currently Amended) The method of claim 28 _52^ wherein said port information 
comprises physical information. 

31 . (Currently Amended) The method of claim 38 _32, wherein said network address 
information extraction and said port information determination is performed in an external 
monitoring device. 

32. (Currently Amended) The method of claim 28. _ A method to monitor a network 
switch, comprising: 

externally obtaining at l east a portion of data packets transmitted from said network switch, 
wherein^each of said data packets comprises network address information: 
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extracting said net work address information from said obtained portion of data packets; 

and 

determining port information of said network address information in response to said 
network address infoimation extraction: 

wherein said network switch comprises a pltirality of regu lar ports and a mirror port, said 
mirror port being able to mirror network traffic for at least one of said regular ports, wherein said 
portion of data packets are obtained from said mirror port. 

33. (Currently Amended) The method of claim 28 wherein said network address 
infoonation comprises source addresses. 

34. (Currendy Amended) The method of claim 38 32, wherein said network address 
information comprises destination addresses. 

35. (Cinrently Amended) The method of claim 38 .32, wherein said network switch 
comprises a plurality of regular ports, wherein said portion of data packets are obtained by 
passively tapping at least one of said regular ports. 

36. (Canceled) 

37. (Currently Amended) The incthod of cloiB a-g^y A method to monitor a network 
switch, comprising : 

PA/52139013.1/2021906-7001772001 O 



PAGE 10/14 ' RCVD AT 10/18/2006 6:49:01 PM [Eastern Daylight Time] ' SVR:USPTO{FXIV-5/16 ^ 



10/18/2006 15:49 FAX 6508494800 



BINGHAM McCUTCHEN LLP 



aoii 



Patent 

2021906-7001772001 
(21906-702) 

externally obtaining at least a porHoTi of data packets tranfimitted froirt said network switch, 
wherein each of s aid data packets comprises network address mfprmation: 

extracting said network address information from said obtained portion of data packets; 

and 

cjfitemtinins port infonnatiQn of said network address informatjon i n response tQ s^d 
network address information extraction: 

wherein said port Information determination comprises Interrogating said network switch 

I 

to obtain said portion of port iltformation using said net work address information: and 
wherein said interrogation comprises: 

sending a first request to said network switch requesting a port index corresponding to said 
network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

38. (Previously Presented) The method of claim 37, wherein said first request and said 
second request are SNMP requests. 

39, (Previously Presented) The method of daim 37, wherein said port infomiation 
determination comprises placing said obtained portion of data packets in a first-in-first-out bviffer 
waiting for responses from said network switch. 
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40. (Previously Presented) The method of claim 39, wherein said port information 
determination further comprises releasing a data packet from said first-in-first-oiat buffer after said 
network switch responds to said first and second requests. 

41. (Previously Presented) The method of claim 39^ wherein said port information 
determination further comprises releasing a data packet from said first-in-first-out buffer after a 
predetermined period of time. 

42. (Currently Amended) The method of claim 38 _32, further comprising maintaining at 
least one lookup table correlating said network address infonnation with said port information. 

43. (Currently Amended) The method of claim 28^ wherein said network switch is a 
routing switch. 

44. . (Currently Amended) The method of claim 38 32. further comprising associating 
said port information with information contained in said obtained portion of data packets. 

45. (Previously Presented) The method of claim 44, further comprising performing 
network analysis of said network switch using said port information and associated data packet 
informatjon. 
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